3.14 things I didn’t know about CSS
summary
Shows concrete surprises: CSS expressions let JavaScript run from CSS (IE5–7) and can be re-enabled via compatibility mode and framing, enabling XSS using only CSS; attribute selectors plus background-image requests let an attacker exfiltrate tokens by brute forcing characters; Martin Cole’s CSS‑only game uses just 12 styleable blocks (html/head/body/link and pseudo‑elements) and works; tools are built to decide when font names or attribute values need quotes and to emit correct CSS escape sequences, and demos prove each claim.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:14Font family names in CSS
- 6:36Unquoted attribute values
- 16:09Classes and IDs in HTML
- 17:48Escaping CSS selectors
- 22:08Injection contexts
- 26:57Stealing data from the DOM
